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(54) Passive remote access control system 

(57) Access to a motor vehicle (23) is controlled by 
periodically transmitting an interrogation signal (43) 
from a control circuit (22) on the vehicle (23). Upon 
receiving the interrogation signal (43), a hand-held 
remote control (21) transmits a reply signal to the con- 
trol circuit (22). The control circuit (22) measures the 
strength of the reply signal and the activates a first func- 
tion (30), such as unlocking a door of the vehicle, when 


the strength exceeds a first threshold level. Thereafter, 
when the signal strength exceeds a second threshold 
level, the control circuit (22) activates a second function 
(30), for example enabling the engine to be started. 
When the signal strength drops below a third threshold 
activates a third function (30), such as locking the door. 
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Description 

Background Of The Invention 

[0001 ] The present invention relates to systems for 
remotely controlling access to motor vehicles, and more 
particularly to wireless remote control systems that can 
be used to unlock vehicle doors, start the engine and 
operate other functions on the vehicle. 
[0002] Automobiles have used keys which mechan- 
ically operate locks to limit access to the vehicle and 
starting the engine to only authorized persons. More 
recently remote keyless entry (RKE) systems have 
been provided that use a small radio frequency (RF) 
transmitter, often having the shape of a key ring fob, to 
access the vehicle. This RF transmitter has a number of 
push button switches allowing the driver to control differ- 
ent functions of the vehicle, such as lock and unlock the 
doors, arm a security system or open the trunk. These 
transmitters also have been proposed to control starting 
the vehicle engine. When a given push button switch is 
operated, the transmitter sends an RF signal which car- 
ries a digital numerical code and a designation of the 
function to be performed. A receiver in the vehicle 
receives the transmitter signal, verifies that the numeri- 
cal code designates an authorized transmitter for that 
particular vehicle and if so, signals the vehicle control 
circuits to perform the prescribed function. 
[0003] Although the identification code provides 
secutity against unauthorized persons gaining access 
to the motor vehicle, concern has been expressed that 
someone with a radio receiver and a digital signal ana- 
lyzer could eavesdrop on the radio transmissions and 
obtain the security numbers. Particular brands of vehi- 
cles use a specific single radio frequency. Thus a thief 
could "stake out" a valuable vehicle to await the return of 
the driver and learn the transmission necessary to oper- 
ate the vehicle. Those security numbers then could be 
utilized to steal that vehicle at a later point in time. Thus, 
as the technology available to thieves advances, so too 
must the signal processing employed by the RKE sys- 
tem. Therefore, there exists a need for a more secure 
radio frequency system that allows keyless entry. 
[0004] Bidirectional radio frequency communication 
has been used for some time in cordless telephones. 
The term "cordless telephone" as used in the telecom- 
munication industry, means a telephone comprising a 
base station and a hand-held transceiver unit. The base 
station is connected by wires to a terrestrial telephone 
line serving the owner's premises. A hand-held trans- 
ceiver carried by the user communicates by radio fre- 
quency signals with the single base station that is up to 
approximately 300 meters away. 
[0005] The Digital Enhanced Cordless Telecommu- 
nications (DECT) protocol was developed in the mid- 
1980's as a pan-European standard for cordless tele- 
phones and has been adapted for use outside the Euro- 
pean Union. The DECT standard protocol has been 



used for simultaneous bidirectional communication 
between a base station and a hand-held transceiver of 
cordless telephones. This standard utilizes ten frequen- 
cies for communication. The exchange of signals over 

s each frequency is divided into frames 10 each having 
twenty-four slots as shown in Figure 1 . The twelve slots 
in the first half 14 of each frame are used for communi- 
cation from a hand-held transceiver to the associated 
base station, while the twelve slots in the second frame 

10 half 16 are used for communication from the base sta- 
tion and the hand-held transceiver. 
[0006] When a user desires to use activates the 
cordless telephone to make an outgoing call, the hand- 
held transceiver searches for a frequency that has a 

16 matching slots in each frame half which are not being 
used by another cordless telephone system. This is 
accomplished by the hand-held transceiver listening for 
digital signals being sent in each slot of the frame at 
each of the assigned frequencies. When a vacant pair 

20 of slots, such as 18 and 19, is found, the hand-held 
transceiver sends a message initiation signal on the 
selected frequency during slot 18 in the first haH of a 
message frame. 

[0007] While the hand-held transceiver is perform- 
25 ing these functions, the base station is scanning the ten 
frequencies and listening during each of the twelve slots 
in the first half 14 of the message frames at each fre- 
quency. When the base station hears a message initia- 
tion signal that is addressed to it. i.e. containing the 
30 proper identification data, the base station sends a 
response to the transceiver in the associated slot 19 in 
the second half of a frame at the same frequency and 
bidirectional communication is established. A reverse 
procedure occurs when the base station receives an 
35 incoming call via the terrestrial telephone line. 

Summary Of The Invention 

[0008] A general object of the present invention is to 
40 provide a remote keyless vehicle entry system which 
does not require manual activation by the user. 
[0009] Another object is to provide secure mecha- 
nism for enabling a driver to start a motor vehicle with- 
out a conventional key. 
45 [0010] A further aspect of the present invention is to 
provide a mechanism for automatically locking the 
doors upon the driver exiting the motor vehicle. 
[0011] Still another aspect of the present system 
allows the vehicle doors and trunk to be unlocked and 
so locked. 

[001 2] These and other objectives are satisfied by a 
passive keyless access system having a remote control 
adapted to be carried by the driver. Access to the vehi- 
cle is controlled by the remote control transmitting a sig- 
55 nal from outside the vehicle to a control circuit on the 
vehicle. The control circuit measures the strength of the 
signal and activates a first function of the vehicle when 
the strength exceeds a first predefined threshold. 
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Thereafter when the strength exceeds a second prede- 
fined threshold, the control circuit activates a second 
vehicle function. For example, the first function can be 
unlocking a vehicle door and the second function can be 
enabling the engine to be started. In that example, the 
first predefined threshold is greater than the second 
predefined threshold. 

[0013] In the preferred embodiment of the present 
invention, transmission of the signals utilizes the Digital 
Enhanced Cordless Telecommunications (DECT) proto- 
col. As an optional feature the control circuit can acti- 
vate a third function of the vehicle when the signal 
strength drops below a third predefined threshold, the 
control circuit activates a second function of the vehicle, 
such as locking the doors as the driver has left the vehi- 
cle. 

Brief Description Of The Drawings 

[0014] 

FIGURE 1 depicts a message frame of the Digital 
Enhanced Cordless Telecommunications (DECT) 
wireless telephone protocol; 

FIGURE 2 is a pictorial diagram of a remote keyless 

entry (RKE) system for a motor vehicle; 

FIGURE 3 is a block schematic diagram of the 

remote keyless entry system; 

FIGURE 4 is a flowchart of the passive entry and 

starting operations of a control circuit in the motor 

vehicle; and 

FIGURE 5 is a flowchart of operation of a hand-held 
remote control. 

Detailed Description Qf Th e In vention 

[0015] With initial reference to Figure 2, a keyless 
motor vehicle control system 20 comprises a driver's 
remote control 21. which preferably has the form of a 
key ring fob carried by a driver, and a control circuit 22 
located in the motor vehicle 23. As will be described, the 
remote control 21 exchanges a radio frequency signals 
with the control circuit 22, which responds by activating 
designated functions of the motor vehicle 23. 
[001 6] As shown in detail in Figure 3. the control cir- 
cuit 22 in the motor vehicle includes a microcomputer 
24 with an internal microprocessor, memory in which 
the control program and data are stored, and input/out- 
put circuits. A standard clock circuit 26 supplies timing 
pulses to the microcomputer 24. The service technician 
is able to place the microcomputer into different func- 
tional modes by operating a plurality of manual input 
switches 27 and 28. Alternatively the configuration of 
the control circuit 22 can be defined by downloading 
data via the radio frequency link. 
[0017] The control circuit 22 operates several func- 
tions on the motor vehicle, such as locking and unlock- 
ing the doors, unlatching the trunk lid, and starting the 



engine, for example. For that functionality, the micro- 
computer 24 is interfaced to the corresponding actuat- 
ing devices on the motor vehicle 23. In some cases, the 
various functions are controlled by an another computer 

5 in the motor vehicle to which microcomputer 24 sends 
operating commands via a parallel communication bus 
36. In other motor vehicles, microcomputer 24 has indi- 
vidual output lines 30 connected directly to the control 
devices for the respective functions being operated. 

io Specifically, separate wires may be coupled to actuators 
which lock and unlock the doors, unlatch the trunk lid 
and start the engine. 

[001 8] A serial output port 32 and a serial input port 
34 of the microcomputer 24 are connected to a first 

15 radio frequency transceiver 35 which utilizes the Digital 
Enhanced Cordless Telecommunications (DECT) 
standard. In a general sense, the first radio frequency 
transceiver 35 modulates a standard RE frequency car- 
rier with the serial digital data received from output port 

so 32 and transmits that modulated radio frequency signal 
via an antenna 37. The first transceiver 35 also receives 
and demodulates radio frequency signals received by 
the antenna 37 to recover serial digital data carried by 
that signal. The recovered data is sent to the microcom- 

25 puter input port 34. A meter 39 is connected to the first 
transceiver 35 to measure the strength of the received 
radio frequency signal and provide an indication of that 
signal strength to microcomputer 24 via another input 
port 33. Alternatively the circuitry in the remote control 

so 21 also may have a signal strength meter for the radio 
frequency signal that it receives. 
[0019] The first transceiver 35 of the control circuit 
22 is designed to communicate with a second radio fre- 
quency transceiver 40 and antenna 42 both located 

35 within the remote control 21 . As will be described, both 
transceivers 40 and 35 are designed to utilize the DECT 
protocol and are similar to devices found in cordless tel- 
ephones. The second transceiver 40 has a receiver sec- 
tion which demodulates the received radio frequency 

40 signal to recover digital data carried by that signal and 
the recovered data is sent in a serial format to an input 
register 44. The input register 44 converts the serial 
data stream from the second transceiver 40 into a par- 
allel format which is read by a controller 46. The corttrol- 

45 ler 46 may be a hardwired device that sequentially 
performs the remote control procedure to be described 
or a programmable device which executes a software 
program to implement that procedure. The controller 46 
of the remote control 21 is connected to an electrically 

so erasable programmable read only memory (EEPROM) 
48 which stores data to be transmitted to the motor vehi- 
cle control circuit 22 when the remote control 21 is inter- 
rogated. 

[0020] A clock circuit 52 also provides timing sig- 
55 nals for the remote control 21 . A plurality of user opera- 
ble switches 54 are connected to different input lines to 
the controller 46 in order for the driver to select the spe- 
cific functions to be performed on the motor vehicle. For 
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example, a separate switch can be provided for the 
functions of unlocking and locking the doors, unlatching 
the trunk lid. and starting the engine. 
[0021] The remote control 21 also includes an 
encryptor 50 connected to the controller 46 to encrypt a 
remote control security number for transmission to the 
control circuit 22. The encryptor 50 utilizes a secret-key 
cryptography algorithm to encrypt data for sending to 
the control circuit. For example, the algorithm specifies 
a sequence of a plurality of logical operations which are 
performed on a known seed number and a challenge 
number received from the control circuit to produce a 
resultant number for transmission by the remote control. 
Several suitable cryptography algorithms are described 
by Mehrdad Foroozesh in an article entitled "Protecting 
Your Data With Cryptography," UNIX Review, Novem- 
ber 1996, volume 14, number 12, page 55(6), which 
description is incorporated herein by reference. Such 
encryption techniques and algorithms are commonly 
used to encrypt computer data being transmitted over 
common carriers. It should be understood that other 
encryption techniques may be used. 
[0022] Digital output data is sent by the controller 
46 in parallel form to a parallel-in/serial-out output regis- 
ter 56. The serial data from the output register 56 is 
applied to the input of a transmitter section in the sec- 
ond transceiver 40 which modulates a radio frequency 
signal which that data. The resultant RF signal is sent 
via the antenna 42 to the control circuit 22 in motor vehi- 
cle. The signal transmitted by the second transceiver 40 
has a range of about 300 meters. The components of 
the remote control preferably are powered by a battery 
(not shown). 

[0023] When the driver desires the vehicle perform 
a given function the corresponding switch 54 can be 
operated on the remote control 21. This results in the 
controller 46 sending a signal to the control circuit 22 
which designates the selected function. This communi- 
cation process is similar to that used in previous remote 
controls for motor vehicles, except that it employs the 
DECT protocol. The designation of the selected function 
is stored in a table within the EEPROM 48 and the func- 
tions associated with each switch 54 are programmable 
via the RF link provided by second transceiver 40. 
[0024] In addition, the present keyless motor vehi- 
cle control system 20 has a passive mode of operation 
in which the driver does not have to operate a switch 54 
on the remote control 21. Instead, a predefined 
sequence of functions is performed by the driver merely 
approaching the motor vehicle 23. 
[0025] With reference to Figures 3 and 4, the motor 
vehicle control circuit 22 in the passive mode periodi- 
cally, every six seconds for example, emits an interroga- 
tion signal at steps 60 and 62. The interrogation signal 
contains a unique identification code for that particular 
motor vehicle and is transmitted sequentially on all ten 
of the DECT frequencies. This process begins by scan- 
ning each of the ten DECT frequencies. If the control cir- 



cuit 22 does not hear a message frame on a given 
frequency, then it forms a new message frame and 
selects an arbitrary pair of time slots to use. If a particu- 
lar frequency already is carrying DECT messages, the 

5 control circuit 22 listens during the message frames for 
an available pair of frame slots, one that does not 
already contain message data. If none is found, the con- 
trol circuit 22 selects the next DECT frequency. When 
an available pair of time slots, such as the third time 

io slots 18 and 19 in each half of the message frame 
shown in Figure 1 , is found, the control circuit 22 trans- 
mits the interrogation signal in the time slot 19 during 
the second half 16 of the message frame. 
[0026] The microcomputer 24 determines at step 

is 64 whether a reply signal has been received and if so, 
whether the reply signal contains an authorized remote 
control identification number. If either is not the case, 
the program execution returns to step 60 to delay before 
sending the interrogation signal again at step 62. 

20 [0027] While this is occurring, the remote control 
21 , at step 90 of Figure 5, listens on a single DECT fre- 
quency for a interrogation signal which contains the 
proper motor vehicle identification code. Alternatively, 
the interrogation signal could be sent on a single one of 

ss the DECT frequencies by the control circuit 22 and the 
remote control 21 could scan all of the DECT frequen- 
cies listening for that signal. However, with this latter 
approach the remote control 21 consumes more power 
which drains its battery faster. 

so [0028] When the driver is within transmission range, 
for example approximately 300 meters of the motor 
vehicle 23, the remote control 21 receives interrogation 
signal and at step 92 determines whether that signal 
contains the identification code for the motor vehicle 

35 that the remote control is to operate. If that is the case, 
the remote control 21 responds with a predefined reply 
signal at step 94. The reply signal is sent at the same 
frequency as the interrogation signal and during a slot in 
the second half of the message frame that corresponds 

40 to the slot of the first frame half that contained the inter- 
rogation signal. That reply contains a unique identifica- 
tion number assigned to the remote control and stored 
in its EEPROM 48. The reply data is sent via output reg- 
ister 56 to the second transceiver 40 from which it is 

45 transmitted to the control circuit 22 in the adjacent motor 
vehicle. As noted previously, any of several well known 
data encryption algorithms may be employed to 
exchange data between the control circuit 22 and the 
remote control 21 for greater security. 

so [0029] Upon receiving a valid reply signal at step 64 
in Figure 4, the microcomputer 24 in the control circuit 
22 advances to steps 66 and 68 at which another inter- 
rogation signal begins to be transmitted at shorter inter- 
vals, every 60 milliseconds for example. The remote 

55 control 21 continues to send a reply signal upon each 
receipt of this interrogation signal. 
[0030] At this juncture, the microcomputer 24 deter- 
mines at step 70 whether a reply signal has been 
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received and if so, whether it contains an authorized 
remote control identification number. If either is not the 
case, the program execution returns to step 60 at the 
beginning of the passive mode. However, when a valid 
reply signal is received by the control circuit 22 at step 
70, the procedure advances to step 72. The microcom- 
puter 24 now examines the input from meter 39 to deter- 
mine whether the strength of the received reply signal 
exceeds a predefined first threshold level X, as occurs 
when the remote control 21 is within a meter of the 
motor vehicle, for example. If the signal strength is 
below this first threshold, i.e. the driver is too far from 
the motor vehicle, the program returns via step 84 to 
step 66. AHernatively the measurement of the signal 
strength could be performed at the remote control 21 
with an indication of that signal strength being transmit- 
ted to the control circuit 22. In yet another variation, both 
the remote control 21 and the control circuit 22 could 
measure the strength of their respectively received sig- 
nals with the control circuit 22 comparing the measure- 
ments to determine the proximity of the remote control. 
[0031] When the signal strength exceeds this first 
threshold X, microcomputer 24 at step 74 checks 
whether a flag, designated START FLAG, has been set 
previously. When the START FLAG has not been set, 
the doors of the motor vehicle are unlocked at step 76 
and the START FLAG then is set at step 78, before the 
process returns to step 66. If the START FLAG is found 
set at step 74, the procedure advances to step 80 where 
the microcomputer 24 examines the input from meter 39 
to determine whether the strength of the received reply 
signal exceeds a predefined second threshold level Y. 
The strength of the reply signal will exceed the second 
threshold level Y when the remote control 21 is inside 
the motor vehicle. In that case, the microcomputer 24 
enables the starting circuit of the motor vehicle 23 so 
that the driver may start the engine by activating a man- 
ual switch on the dashboard. Thus the driver with the 
proper remote control 21 for the motor vehicle may start 
the engine without using a key. The procedure then 
returns to step 60. If the signal strength is found to be 
below threshold Y at step 80, i.e. the driver is not inside 
the motor vehicle, the program returns to step 66 with- 
out enabling the starting circuit. 
[0032] After the starting circuit has been enabled, 
the keyless control system 20 continues to exchange 
interrogation and reply signals between the control cir- 
cuit 22 and the remote control 21. While the driver is 
within the motor vehicle, the strength of the reply signal 
will exceed the first threshold level X at step 72 causing 
the program execution pass through steps 74, 80 and 
82 and return to step 66. Eventually the driver will man- 
ually turn-off the engine and exit the motor vehicle 23. 
As the driver walks away from the vehicle, the signal 
strength drops below the first threshold level X. When 
this occurs, the procedure branches to step 84 where 
the START FLAG is found to be set. As a result, the 
START FLAG will be reset at step 86 before the doors 



are locked at step 88. Then the program returns to step 
60 to await the driver again approaching the motor vehi- 
cle for reentry. 

s Claims 

1. A method for controlling access to a vehicle (23) 
which has a door and an engine, that method com- 
prising the steps of: \ 

(a) transmitting a signal from a remote control 
(21) outside the vehicle (23); 

(b) receiving the signal (43) at the vehicle; 

(c) measuring strength of the signal at the vehi- 
is cle; 

(d) activating a first function (30) of the vehicle 
when the strength of the signal (43) exceeds a 
first predefined threshold; and 

(e) thereafter repeating steps (a) through (c), 
so and activating a second function (30) of the 

vehicle when the strength of the signal (43) 
exceeds a second predefined threshold. 

2. The method as recited in claim 1 wherein the step 
ss of transmitting a signal (43) comprises sending a 

unique identification number assigned to the 
remote control; and the step of receiving the signal 
at the vehicle comprises verifying that the unique 
identification number is valid for operating the vehi- 
30 cle. 

3. The method as recited in claim 1 wherein the step 
of activating a first function comprising unlocking a 
door of the vehicle. 

35 

4. The method as recited in claim 3 wherein the step 
of activating a second function comprising enabling 
the engine to be started. 

40 5. The method as recited in claim 4 wherein the first 
predefined threshold is greater then the second 
predefined threshold. 

6. The method as recited in claim 1 wherein the sec- 
45 ond predefined threshold is exceeded substantially 

only when the remote control is inside the vehicle. 

7. The method as recited in claim 1 wherein the step 
of transmitting a signal utilizes the Digital Enhanced 

so Cordless Telecommunications (DECT) protocol. 

8. The method as recited in claim 1 further comprising 
activating a third function of the vehicle when the 
strength of the signal becomes less than a third pre- 
ss defined threshold. 

9. The method as recited in claim 8 wherein the step 
of activating a third function comprising locking the 
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door of the vehicle. 

10. A method for controlling access to a vehicle (23) 
which has a door and an engine, that method com- 
prising the steps of: s 

(a) periodically transmitting a first interrogation 
signal at a first rate from a control circuit on the 
vehicle: 

(b) receiving the first interrogation signal at a 10 
remote control that is separate from the vehi- 
cle; 

(c) upon receiving the first interrogation signal, 
transmitting a first reply signal from the remote 
control; is 

(d) receiving the first reply signal at the control 
circuit; 

(e) after receiving the first reply signal, periodi- 
cally transmitting a second interrogation signal 

at a second rate from the control circuit; 20 

(f) receiving the second interrogation signal at 
the remote control; 

(g) upon receiving each second interrogation 
signal, transmitting a second reply signal from 
the remote control; 25 

(h) receiving each second reply signal at the 
control circuit; 

(i) measuring strength of each second reply 
signal at the control circuit: 

(j) activating a first function of the vehicle when so 
the strength exceeds a first predefined thresh- 
old; and 

(k) activating a second function of the vehicle 
when the strength exceeds a second prede- 
fined threshold. 3s 

11. The method as recited in claim 10 wherein trans- 
mission of signals utilizes the Digital Enhanced 
Cordless Telecommunications (DECT) protocol. 

40 

12. The method as recited in claim 10 wherein the first 
rate is slower than the second rate. 

13. The method as recited in claim 10 wherein the step 

of activating a first function comprising unlocking a 4s 
door of the vehicle. 

14. The method as recited in claim 13 wherein the step 
of activating a second function comprising enabling 
the engine to be started. so 

15. The method as recited in claim 14 wherein the first 
predefined threshold is greater then the second 
predefined threshold. 

55 

16. The method as recited in claim 10 further compris- 
ing activating a third function of the vehicle when 
the strength becomes less than a third predefined 



threshold. 

17. The method as recited in claim 16 wherein the step 
of activating a third function comprising locking the 
door of the vehicle. 

18. The method as recited in claim 16 further compris- 
ing returning to step (a) after activating a third func- 
tion. 

19. A method for controlling access to an object (23) 
having an enclosed area, said method comprising 
the steps of: 

(a) transmitting a signal from a remote control 
to the object; 

(b) receiving the signal at the object; 

(c) measuring strength of the signal received at 
the object; 

(d) enabling access to the enclosed area when 
the strength of the signal exceeds a first prede- 
fined threshold; and 

(e) thereafter repeating steps (a) through (c) 
and activating a given function of the object 
when the strength exceeds a second prede- 
fined threshold. 

20. The method as recited in daim 19 wherein the step 
of transmitting a signal comprises sending a unique 
identification number assigned to the remote con- 
trol; and the step of receiving the signal comprises 
verifying that the unique identification number is 
valid for accessing the object. 

21. The method as recited in claim 19 further compris- 
ing disabling access to the enclosed area when the 
strength of the signal is less than a third predefined 
threshold. 
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